Summary
In Ruby resolv gem, there is insufficient checking of the length of a decompressed domain name extracted from a compressed form in a DNS packet. An attacker can supply a highly compressed domain name that expands to a very long name, consuming excessive CPU during decompression. This may result in a DoS via malformed DNS packet.
Products Potentially Affected
|
OS/Product
|
Exposure
|
|
ExtremeControl for Site Engine
|
Yes
|
Repair Recommendations
ExtremeControl for Site Engine:
- Fixed in 25.08.12 or later
Please see the full Security Advisory here for more details and future updates.
